CVE-2026-12433

Name of the Vulnerable Software and Affected Versions Hydra Booking – Appointment Scheduling & Booking Calendar versions prior to 1.2.2

Description An Insecure Direct Object Reference exists in the /wp-json/hydra-booking/v1/booking/details/{id} REST endpoint. The getBookingDetails() callback enforces the tfhb manage options capability through tfhb manage options permission() but fails to verify if the requested booking belongs to the authenticated host. Because the getBookingDetailsData() function filters only by the booking ID provided in the URL, authenticated attackers with Hydra Host-level access or higher can view sensitive booking records of other hosts. Exposed data includes attendee names, emails, phone numbers, addresses, meeting details, payment method and status, transaction history, and internal notes.

Recommendations Update the plugin to a version newer than 1.2.1. Restrict access to the /wp-json/hydra-booking/v1/booking/details/{id} endpoint to minimize the risk of unauthorized data exposure.